84 lines
2.1 KiB
Markdown
84 lines
2.1 KiB
Markdown
# NixOS Configuration
|
|
|
|
Personal NixOS configuration using the [den](https://github.com/vic/den) framework (dendritic pattern).
|
|
|
|
## Hosts
|
|
|
|
| Hostname | Profile | GPU |
|
|
|------------|----------------------|--------|
|
|
| `desktop` | Gaming + development | Nvidia |
|
|
| `notebook` | Portable development | Intel |
|
|
|
|
## Prerequisites
|
|
|
|
- [just](https://github.com/casey/just): `nix shell nixpkgs#just`
|
|
- [nvd](https://github.com/khumba/nvd) for `just diff`: `nix shell nixpkgs#nvd`
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
# Rebuild and switch (uses current hostname automatically)
|
|
just switch
|
|
|
|
# Target a specific host
|
|
just switch desktop
|
|
just switch notebook
|
|
|
|
# Build only, without switching
|
|
just build
|
|
|
|
# Test (applies temporarily, reverts on next boot)
|
|
just test
|
|
|
|
# Update all inputs
|
|
just update
|
|
|
|
# Update a single input
|
|
just update-input nixpkgs
|
|
|
|
# Run garbage collection
|
|
just gc
|
|
|
|
# See what changed before switching
|
|
just diff
|
|
```
|
|
|
|
## Secrets (SOPS + age)
|
|
|
|
Secrets are stored encrypted in `secrets/secrets.yaml` and decrypted at boot by [sops-nix](https://github.com/Mic92/sops-nix).
|
|
|
|
### First-time setup on a new machine
|
|
|
|
1. Generate an age key:
|
|
```bash
|
|
mkdir -p /etc/sops/age
|
|
age-keygen -o /etc/sops/age/keys.txt
|
|
```
|
|
|
|
2. Add the new public key to `.sops.yaml` under `keys:`.
|
|
|
|
3. Re-encrypt secrets for all keys:
|
|
```bash
|
|
sops updatekeys secrets/secrets.yaml
|
|
```
|
|
|
|
### Adding a new secret
|
|
|
|
1. Edit the secrets file: `just secrets`
|
|
2. Declare it in `modules/secrets.nix` under `sops.secrets`.
|
|
|
|
### Rotating the age key
|
|
|
|
1. Generate a new key (step 1 above).
|
|
2. Update `.sops.yaml` with the new public key.
|
|
3. Run `sops updatekeys secrets/secrets.yaml` to re-encrypt.
|
|
|
|
## Identity
|
|
|
|
All user identity (name, email, SSH key) lives in `modules/identity.nix`. Override the defaults there or in a profile-specific module when creating a new user profile.
|
|
|
|
## Adding a new host
|
|
|
|
1. Run `nixos-generate-config` on the target machine and copy the output to `modules/_hardware/<hostname>-hardware.nix`.
|
|
2. Add the host in `modules/den.nix` under `den.hosts`.
|
|
3. Define or reuse an aspect for the host profile.
|